# Log-In and the Session: Trust Surfaces in Telehealth Mental Health Healthcare keeps pulling me back. I volunteered at a family clinic in high school and a women's shelter in college, and the thing I could not stop noticing in both places was the distance between the people in the waiting room and the expertise that existed somewhere else. Women, people of color, and LGBTQ+ people are the groups the data keeps flagging as the least connected to the research, the specialists, and the plain information that changes how a life goes, or how long it lasts. At Kaiser I learned what it costs to move regulated data safely ([[Kaiser Permanente Case Study]]). This case study is the other half of that education: what the front door of care should feel like when the door itself is a trust surface. The subject is a queer-founded, trauma-informed telehealth therapy practice, in-network with Medicaid across Maryland, Virginia, and DC, hiring pre-licensed clinicians, and pointed at a fourth state. Medicaid sessions cost the patient nothing, which means price is rarely the leak. The leaks live in eligibility, in matching, in the gap between booking and the first session, and in the therapist queue between hired and billable. I am going to sketch both doors, and the room they share, before anyone tells me what is feasible, because the finest architecture starts with artful drafts in pen, paper, and charcoal. The feasibility conversation is real and it comes second. ## The patient door Most of the peer platforms open the same way. Headway, Grow, Rula, and Zocdoc show a therapist's calendar before you have an account; Talkspace and BetterHelp run a questionnaire first and match you to one person you did not choose; Alma lets you browse anonymously and books a fifteen-minute consult; the practice I am studying starts with a phone call to a care coordinator who verifies coverage by hand and asks about identity and availability out loud. None of the therapy platforms I looked at offers passkeys. Epic's MyChart does, which says the technology is ready and the category is behind. Rula tried emailed links and retired them for passwords, social sign-in, and one-time codes. Password-first is the industry default, and the industry default is a leak. ![[telehealth-patient-flow.png]] **First time.** The front door asks where you are, who covers you, and what matters to you in a therapist, before any account exists. Eligibility runs in the same sitting, a 270/271 through a clearinghouse, and the design has to know the failure modes. A 271 that says active is talking about the medical plan; behavioral health is often carved out to a separate organization with its own payer id and its own network, and in Maryland Medicaid the carve-out is total: specialty behavioral health sits with an administrative services organization, and the managed care plan on the card is beside the point for therapy. Most "we could not verify your coverage" moments are a nickname, a typo in a birthdate, a query aimed at the wrong payer, or a plan reassignment the state system has not caught up with. The product should say which one, in plain words, and offer the next step. Then the match, and a match is only valid when the therapist is licensed in the patient's state, enrolled with the patient's plan, and fits what the patient asked for. The account is born at the moment of a real appointment, with a passkey or a one-time code, and the chosen name, pronouns, and safe-contact rules are set once, right there. ``` ┌───────────────────────────────────────────────────────┐ │ Let us find you the right person. │ │ │ │ Where are you right now? [ Maryland ▾ ] │ │ Who covers you? [ Medicaid ▾ ] │ │ Plan on your card [ Priority Part ▾ ] │ │ ✓ In network. Sessions cost you $0. │ │ │ │ What matters to you in a therapist? │ │ [ LGBTQ+ identified ] [ BIPOC ] [ trauma-informed]│ │ [ trans and nonbinary experience ] [ evenings ] │ │ │ │ Name you go by [ Sam ] │ │ Name on your card [ ________________ ] (billing │ │ only) │ │ │ │ [ Show me three people → ] │ │ │ │ No account yet. We ask for one when you book. │ └───────────────────────────────────────────────────────┘ ``` **Returning.** The reminder reads as neutral on a lock screen, with no diagnosis, no clinic name, and no PHI in a push or an SMS. Joining is one tap, a passkey on the device that booked or a signed link bound to that device, which is phishing-resistant and asks the patient to type nothing. Then the threshold. Licensure follows the patient's physical location at the time of the visit, and the interstate compacts are still arriving (the Counseling Compact only began issuing privileges in late 2025 and the Social Work Compact has no multistate license yet), which means the room has to ask "where are you right now" every time and write the answer to the audit log. The threshold also shows the consent state for this session before the door opens. ``` ┌──────────────────────────────────┐ │ Thursday · 6:00 PM · with Rae │ │ │ │ Where are you right now? │ │ ( • ) Maryland, same as usual │ │ ( ) Somewhere else │ │ │ │ This session │ │ Recording off │ │ AI notes off │ │ Session partner none invited │ │ │ │ [ Join with this device ] │ │ │ │ Leave quickly: tap the corner │ │ twice and the screen goes blank.│ └──────────────────────────────────┘ ``` **Where bespoke LGBTQ+ care changes the door.** The chosen name belongs in the room and the legal name on the claim. The 271 needs the name on the card, the person does not, and the billing layer should hold one while the room shows the other without the therapist ever asking. Pronouns and the preferences that made the match travel with the match as part of the therapist's brief, because the explaining is often what drove the patient to a queer-founded practice in the first place. Safe-contact rules are a first-class object, covering who may know, how reminders read, which channel is safe, and a quick exit on a shared device. Minors are state logic: teens consent to outpatient mental health care on their own in Virginia at any age, in DC for ninety days before reassessment, in North Carolina at any age, and in Maryland from twelve. A parent proxy is its own role with its own credential and a clinician override, and the Cures Act already draws the line the product needs, progress notes released to the patient by default, psychotherapy notes flagged apart. ## The provider door The job description calls it a portal that takes a therapist from sign-up to first-patient-ready. Turns out "ready" has a different definition in every state, and the definition changes again with license tier. ![[telehealth-provider-flow.png]] On a whiteboard the pipeline runs through seven boxes, from apply, verify, and attest to enroll, credential, supervise, and open availability. Then I started pulling on the threads, and every one of them had a clock tied to it. Verification is the quick part and it belongs to the practice, covering the licensing board, an NPDB continuous query at two dollars and fifty cents a head, the OIG and SAM exclusion lists, and under the 2025 NCQA standards those exclusion checks recur monthly with a timestamp an auditor can read. Attestation belongs to the therapist, and it is the first place I found gunk. A CAQH profile (now branded DataSpring) has eighteen sections, cannot be attested until every one is complete, and expires every 120 days; let it lapse and claims quietly go on hold. Enrollment runs on the state's clock. Maryland is moving its provider portal from ePREP to MPRIME this fall, with application holds ahead of the cutover, which means a therapist hired this summer may have been standing in a line that was closed. Credentialing runs on each payer's clock, one queue per managed care plan, and the peers publish what that costs: Headway tells clinicians three weeks to four months plus up to eight weeks for the payer to load the record, Grow says some payers run past six months, SonderMind says instant for delegated networks and up to 120 business days otherwise. Turns out a therapist can clear every check the practice controls and still sit as paid, idle capacity for a season, because a payer committee meets once a month and the file landed the day after. What surprised me is how much of this is active management. Nothing in the pipeline runs on its own. Somebody watches the 120-day attestation clock for every therapist. Somebody knows that a managed care plan may sign a provider while state enrollment is still pending, for at most 120 days, after which the plan has to terminate the contract. Somebody notices that DC paused its behavioral health carve-in to managed care in early 2024 and the page still says paused, that North Carolina paused delegated credentialing for funding reasons, that Maryland pays nothing before the effective date and never retroactively, that a supervision contract needs board approval before session one and a co-signature within a business day after it. All of it shows up in time-to-first-patient. What license tier does to "ready" is the part that redraws the portal. In Maryland, a clinician who is not independently licensed cannot enroll in Medicaid individually and cannot be paid outside a licensed facility, which means the pre-licensed hiring push does not reach Maryland Medicaid at all under a group-practice model. In Virginia, residents and supervisees bill through the supervisor, and the state removed the ninety-day grace period after a license expires as of July 2025: enrollment ends the day the license does. In DC, graduate licensees deliver inside DBH-certified agencies under a qualified practitioner, and whether a group practice can bill for them is unconfirmed, which is itself a finding. North Carolina is the outlier: associates enroll directly under their own NPI, same codes, same rates, no supervisor on the claim, and one extra step, a written service order before the first treatment. A therapist onboarding portal has to be state-parametric from its first version because the states disagree about what a therapist is. ``` ┌─────────────────────────────────────────────────────────────┐ │ Rae Okafor · LGPC (MD) · Resident in Counseling (VA) │ │ │ │ Ready in Virginia ✓ since Aug 21 │ │ Blocked in Maryland ✗ facility pathway only │ │ Pending in DC … DBH agency enrollment │ │ │ │ Stage Owner In stage Longest pole │ │ Verify credentialing done │ │ Attest (CAQH) Rae done re-attest Dec 19 │ │ Enroll VA PRSS credentialing done │ │ Credential credentialing 41 days Sentara │ │ Supervision clinical done co-sign < 1 day │ │ │ │ Sessions stamped this month: 12 · all attested-and-current │ └─────────────────────────────────────────────────────────────┘ ``` **Where the parallel flows are.** Almost everything above is drawn as a line and behaves as a set of independent queues, and that is the opportunity. Verification and attestation can start the day the offer is accepted, side by side, because the practice owns one and the therapist owns the other. State enrollment and payer credentialing fan out, each payer its own queue with its own committee cadence, and readiness is per payer: a Virginia therapist can open availability to Medicaid fee-for-service patients the week that enrollment lands while Aetna is still in review. Submissions can be committee-aware, timed to land before a payer's monthly meeting, a calendar trick worth a month when the file would otherwise arrive the day after. Supervisors can be enrolled and credentialed ahead of the pre-licensed hires who will bill through them, a bench that is ready before the hires are. Delegated credentialing is the compounding investment, three to nine months to stand up plus a file audit, and then days per therapist for as long as the agreement holds, in the states that accept it. And the whole queue wants the treatment I gave production systems for years, with a stage clock on every therapist, a service-level target per stage, an alert when one payer's time-in-stage drifts, and a named owner on the row. The gunk is real, and most of it becomes legible the moment someone instruments it. **Verification of the verification.** Every session stamps license status, enrollment effective date, and supervision approval as of that date, and the room does not open without the stamp. This is the part I would build first, before any dashboard, because it is the thing an auditor asks for and the thing a payer clawback turns on. The queue between hired and billable is paid, idle capacity. Time-in-stage with a named owner is the supply metric, and the longest pole is usually a payer. A companion page, [[Allswell Case Study]], draws both doors in a real practice's own colors across the patient and provider screens. ## The trust boundary ![[telehealth-trust-boundary.png]] HIPAA is a design material here, the driving one. The Security Rule requires unique user identification, person or entity authentication, and audit controls, and it lists automatic logoff and encryption as addressable, which means you implement them or document why an alternative is equivalent. The proposed update would make multi-factor authentication, encryption at rest and in transit, and an annual compliance audit mandatory across the board; it has slipped to a July 2027 target on the regulatory agenda, and I would build to it anyway, because enforcement already expects it. NIST's 2025 digital identity guidelines put passkeys at AAL2, require verifiers to offer at least one phishing-resistant option, and set re-authentication after an hour idle. A passkey on a phone is the friendliest thing in that document, and it is also the most secure thing most patients will ever hold. Vendors are a boundary question. The video vendor signs a BAA and runs in a mode that names rooms randomly, disables cloud recording, and never stores chat. The identity provider signs a BAA. Google Analytics does not offer one and says so, and the OCR tracking bulletin still holds that anything on an authenticated page, or any intake answer, is protected. The FTC fined BetterHelp $7.8 million for sending intake answers to ad networks, and Maryland's 2025 privacy law bans the sale of sensitive data, mental health status included, consent or no consent. Analytics run on first-party events only, cohorted by state, payer, channel, and license tier. Third-party pixels stop at the front door. The consent ledger is its own service because consent is a product: recording, AI notes, partner invites, and proxy access are each per session, revocable, and all-party wherever the patient is sitting, since Maryland requires every party's consent to record and the patient's location controls. The room asks the ledger before anything is recorded. ## The room, sketched widely If the practice owns its video surface, the whole session is a design space, and this is where I want to ideate before the feasibility conversation. **Live feedback, private by construction.** A single tap the patient can make mid-session, "how is this landing," visible only to the therapist as a quiet indicator. There is no transcript, no recording, and no model listening. The signal lives and dies inside the room. Voice biomarkers are real (a 2025 study of two thousand care-management calls predicted depression scores with useful accuracy) and clinician-facing fidelity scoring is sold today. Both raise the question of whose consent, patient and clinician, and what the job looks like when the software grades the therapist. I would start with the tap and earn the right to more. **A session partner, by the patient's hand.** Chosen family matters in queer life, and the low-tech version already exists: Grow tells patients to forward the reminder email. The designed version is a time-boxed invitation the patient issues for one segment of one session, with the therapist admitting from a waiting room and the ledger recording who was present for what. The screen adds a partner rail beside the video, a countdown, and a one-tap dismiss. ``` ┌──────────────────────────────────────────────────────────┐ │ ┌──────────────────────────────┐ ┌────────────────────┐ │ │ │ │ │ In this room │ │ │ │ Rae (they/them) │ │ Sam · you │ │ │ │ │ │ Rae · therapist │ │ │ │ │ │ Jo · partner │ │ │ │ │ │ 12:40 left │ │ │ │ │ │ [ end Jo's ]│ │ │ │ │ │ [ segment ]│ │ │ │ │ ├────────────────────┤ │ │ │ │ │ How is this │ │ │ │ │ │ landing? │ │ │ │ │ │ (Rae sees this, │ │ │ │ │ │ nobody else) │ │ │ └──────────────────────────────┘ │ [ ○ ] [ ◑ ] [ ● ]│ │ │ Recording off · AI notes off └────────────────────┘ │ └──────────────────────────────────────────────────────────┘ ``` **After, in under a minute.** Feedback-informed treatment has twenty-plus years of evidence and a four-item instrument, the Session Rating Scale, that clinicians accepted precisely because it takes less than five minutes. Progress feedback improves outcomes modestly and reduces dropout, and the therapeutic alliance is a stronger predictor of dropout than any demographic variable; Talkiatry's 2025 data put weak alliance at 2.6 times the early dropout risk. I could not find a major platform that documents a one-tap post-session rating. That is white space. Four sliders sit on the way out, did we talk about what you wanted, did the approach fit, did you feel heard, how did it go overall, and the alliance score at session one becomes the earliest retention signal the practice has. PHQ-9 and GAD-7 on a two-week cadence ride along with the reminder, the way SonderMind and Alma already do it. ``` ┌──────────────────────────────────┐ │ Thank you, Sam. One minute. │ │ │ │ We talked about what I wanted │ │ ○────────────────●──○ │ │ The approach fit me │ │ ○──────────────────● │ │ I felt heard │ │ ○───────────────●───○ │ │ Overall │ │ ○─────────────────●─○ │ │ │ │ [ Done ] [ I want to say more]│ │ │ │ Your therapist sees these. Your │ │ care coordinator sees a trend. │ └──────────────────────────────────┘ ``` **Patient-owned recordings.** Nobody offers this, and the reasons are good ones, which is exactly why it is worth a sketch. The patient holds the key, the file lands in storage the patient controls, the therapist consents per session, and the practice keeps only the fact that a recording exists. The ethics baseline is old and clear: consent covers purpose, use, retention, and revocation without penalty. This would be a probe, in the [[Thesis - Ship Probes, Not Monoliths|probes over monoliths]] sense, with a handful of patients who ask for it. ## Referrals, and the Midi callback Midi Health started with about 150 women in a pilot who said, at the end, that they had nowhere else to go and that the company could not go away. Joanna Strober has said that was what gave them the confidence to raise money, and that it was hard to raise. Half of Midi's patients now arrive by word of mouth, from friends and book groups, and primary care physicians and oncologists send the conversation they do not have six minutes for to a place that does. Strober is blunt about the engine underneath: "To build a big healthcare company, you need to have insurance coverage," and "We don't try to do anything fancy. We just get basic insurance coverage." The takeaways carry straight over to a queer-founded practice. Pilot until patients say you cannot go away. In-network is the growth engine, because word of mouth only converts when there is no price objection at the end of it. Design for referral by the clinician who has six minutes. Seed where the trusted voices already are, and measure the spike. Protect the trust as revenue pressure grows, since the same population that arrived on trust leaves on an upsell. Referral loops in a Medicaid-heavy practice have a legal shape. Therapist-to-therapist bonuses are common (Headway pays $350, Alma $500) and Alma's terms carry the sentence a compliance officer wants, that bonuses are never payment for patient referrals or claim volume. Patient-to-patient rewards are a different animal: the beneficiary inducement rules cap gifts at fifteen dollars an item and seventy-five a year, exclude cash and cash equivalents entirely, and Virginia's Medicaid rules for community mental health providers prohibit incentives to enrolled or prospective members outright. The design answer is a reward-free door, built from a shareable link that says "hold this door open for someone," a therapist referral program with Alma's language, and a clinician referral channel built for the six-minute doctor, with a one-page fax-and-portal path because that is still how a lot of primary care refers. ## What I would measure | Signal | Why it is the one | |---|---| | Booked and attended first sessions per week | The number the job description is built around, with show rate in scope even though the bullet stops at the booking | | Eligibility pass rate by payer, with failure reason | The leak most likely to be a fixable data problem, and an alert when one payer drifts | | Time-to-first-patient by state, payer, and license tier | The supply twin, with time-in-stage and an owner per stage | | Return-login success rate and time to join | The password tax, measured; passkeys should push this toward one tap | | Alliance score at session one | The earliest retention signal there is, and the one nobody collects in one tap | | Consent completion and revocation counts | Consent is a product; a product has usage | | Chosen-name and safe-contact adoption | How much of the bespoke promise patients actually reach for | ## The deeper point A log-in is a promise about what happens after it. In most software the promise is convenience. In therapy for people who have spent years explaining themselves, the promise is that the explaining is over and the room is safe, and every control in this sketch sits next to the consequence it governs ([[UX - Controls Near the Consequence]]), with the name next to the claim, the consent next to the record button, the location next to the license, and the stamp next to the session. The compliance work and the care work turn out to be the same work. Kaiser taught me the cost of moving regulated data. This is the version where the cost buys something a patient can feel. **Side note, anchored here on purpose.** I have been evaluating screen recording tools, and Cap, an open-source Loom alternative I was comparing, shipped "HIPAA compliance" as a changelog entry on August 13, 2026, with BAAs signed from the dashboard on the Pro plan with no enterprise tier, every production vendor covered, recordings written straight to your own S3 bucket so PHI never touches their servers, screen and webcam saved as separate tracks so PHI can be redacted, and AI captions you can switch off. A compliance program showed up in a release note between two bug fixes. That is the pattern from [[Delve.co Case Study]] arriving in a consumer-grade tool, and it is also, almost exactly, the storage model the patient-owned recording sketch above would need. I went shopping for a screen recorder and came back with a reference architecture. ## Links - [[Kaiser Permanente Case Study]] - where I learned the cost of moving regulated data - [[Delve.co Case Study]] - compliance as compute, and write-only evidence - [[Skeleton Spec (PRD) - Secure Variables in SaaS]] - store it once, secure it everywhere, use it without seeing it - [[Thesis - Current tools are lossy membranes]] - the handoff problem, seen from the patient's side of the glass - [[Allswell Case Study]] - the same two doors, drawn in one practice's own colors - [[Product Explorations]] - more case studies ## Glossary The acronyms and trade terms above, in plain words. **Coverage and claims** - **270/271** - the eligibility transaction pair. A 270 asks a payer whether a person is covered; the 271 answers with status, plan, and cost share. "Active" on a 271 describes the medical plan, which is why carve-outs matter. - **Clearinghouse** - the switchboard between a practice and hundreds of payers; routes 270/271 checks and claims (Availity, Stedi, Waystar). - **Payer / plan** - the organization that pays for care (Medicaid, a commercial insurer) and the specific product a person holds. - **Medicaid** - state-run, federally matched coverage for people with low income; each state writes its own rules. - **MCO** - managed care organization; a private plan a state pays to run Medicaid for its members (Priority Partners in Maryland, Sentara in Virginia). Credentials providers separately from the state. - **Fee-for-service (FFS)** - the state pays the provider directly per visit, no MCO in between. - **Carve-out / ASO** - a state pulling behavioral health out of its MCOs and handing it to an administrative services organization (Carelon in Maryland) that pays those claims on the state's behalf; the plan on the card is beside the point for therapy. - **In-network** - the therapist holds a contract with the plan, and the patient pays the in-network rate, which for Medicaid is nothing. - **Effective date** - the day an enrollment or credential takes effect; nothing before it is paid. **Credentialing and licensure** - **Credentialing** - a payer's review of a clinician's license, training, history, and sanctions before it will contract and pay. Runs once per payer. - **Enrollment** - registering with a state Medicaid program so claims can be paid; separate from credentialing and usually the gate to it. - **CAQH / DataSpring** - the shared clinician profile every payer reads; must be complete and re-attested every 120 days. Attestation is the clinician's signed statement that it is accurate. - **PSV** - primary source verification; checking a credential with the body that issued it (the board, the school). - **NPDB** - the National Practitioner Data Bank, a federal record of malpractice payments and adverse actions. A continuous query is a standing subscription that reports new entries. - **OIG LEIE / SAM** - federal exclusion lists (the Office of Inspector General's List of Excluded Individuals and Entities, and the System for Award Management). Anyone on them cannot be paid by federal programs; checked monthly. - **NCQA** - the National Committee for Quality Assurance, whose standards say how credentialing is done and how often (every 36 months). - **Delegated credentialing** - a payer contracting the practice to credential its own clinicians under NCQA-style rules, turning months per clinician into days. - **NPI** - National Provider Identifier. Type 1 is a person, Type 2 an organization; a claim names who rendered and who bills. - **License tiers** - LGPC and LMSW (Maryland graduate licenses, supervised practice); Resident in Counseling and Supervisee in Social Work (Virginia); LCMHCA, LCSWA, LMFTA (North Carolina associates); LCPC, LCSW-C, LPC, LCSW, LMFT (independent, fully licensed). - **Pre-licensed / provisional** - a clinician with the degree and a graduate or associate license, practicing under supervision until hours and exams are done. - **Supervision contract / co-signature** - the board-approved agreement naming the supervisor, and the supervisor's sign-off on notes where a payer requires it. - **State enrollment portals** - ePREP and its replacement MPRIME (Maryland), PRSS (Virginia), DCPDMS (DC), NCTracks (North Carolina). - **DBH** - DC's Department of Behavioral Health, which certifies the agencies through which graduate licensees can deliver Medicaid services. - **Service order** - North Carolina's written referral from a physician, psychologist, NP, or PA before an associate's first treatment. - **Time-in-stage** - how long a clinician has sat in one step of the pipeline; the supply-side latency metric. - **Interstate compacts** - agreements that let a clinician practice across member states (PSYPACT for psychologists, the Counseling Compact, the Social Work Compact); the latter two are still coming online. **Identity, privacy, and the session** - **HIPAA** - the federal health privacy law. Its Privacy Rule governs use and disclosure; its Security Rule governs electronic safeguards. - **PHI** - protected health information: anything that identifies a person and relates to their health, care, or payment. - **BAA** - business associate agreement; the contract a vendor signs to handle PHI under HIPAA. No BAA, no PHI. - **OCR** - the HHS Office for Civil Rights, which enforces HIPAA. The FTC polices health data outside HIPAA's reach. - **NPRM** - notice of proposed rulemaking; a draft regulation open for public comment. - **Required vs addressable** - Security Rule terms. Required means implement it; addressable means implement it or document an equivalent. - **NIST SP 800-63 / AAL2** - the federal digital identity guidelines. Authenticator assurance level 2 means multi-factor, with at least one phishing-resistant option offered. - **Passkey** - a cryptographic credential stored on a device and unlocked by biometrics or a PIN. Nothing to type, nothing to phish. - **Phishing-resistant** - authentication bound to the real site, which a fake site cannot replay. - **One-time code** - a short code sent by text or email that works once. - **IdP** - identity provider; the service that authenticates users. - **Audit log** - the append-only record of who did what, when, from where, on which record. - **Consent ledger** - the record of what a patient has agreed to, per session, revocable. - **All-party consent** - a recording law under which everyone on the call must agree (Maryland). One-party states need one person's consent. - **Location attestation** - the patient confirming where they physically are at session time, because licensure follows the patient's location. - **Cures Act / psychotherapy notes** - the federal rule that patients get their records without blocking. Psychotherapy notes, a therapist's private process notes kept apart from the chart, are excluded; progress notes are not. - **Proxy access** - a parent or guardian's role in a minor's record, with a clinician override. **Care and measurement** - **Therapeutic alliance** - the working bond between patient and therapist; the best early predictor of whether someone stays. - **Feedback-informed treatment / SRS** - brief, routine patient feedback used to adjust care. The Session Rating Scale is its four-item, sub-minute instrument. - **PHQ-9 / GAD-7** - the standard nine-item depression and seven-item anxiety questionnaires, scored on a cadence. - **Trauma-informed** - care built on the assumption that trauma is common and re-traumatization avoidable. - **Beneficiary inducement** - the federal rule against giving Medicare or Medicaid patients things of value to influence where they get care; nominal gifts capped at $15 per item and $75 a year, and cash or gift cards do not qualify. ## Sources - HHS, HIPAA Security Rule technical safeguards, 45 CFR 164.312, and the [Security Rule NPRM fact sheet](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html); [HIPAA Journal on the final rule slipping to July 2027](https://www.hipaajournal.com/hipaa-security-rule-update-postponed/) - HHS, [Use of online tracking technologies bulletin](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html); [Google Analytics HIPAA statement](https://support.google.com/analytics/answer/13297105); [FTC BetterHelp order](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising) - NIST, [SP 800-63B-4 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html) - Daily, [HIPAA mode requirements for video rooms](https://docs.daily.co/guides/privacy-and-security/hipaa) - Carelon Behavioral Health of Maryland, [Public Behavioral Health System provider manual](https://www.schoolmentalhealth.org/media/som/microsites/ncsmh/documents/youth-care-coordination/Carelon-Maryland-PBHS-Provider-Manual.pdf); Virginia DMAS, [provider enrollment requirements effective July 1, 2025](https://vamedicaid.dmas.virginia.gov/bulletin/updated-provider-enrollment-requirements-effective-july-1-2025); NC Medicaid, [Clinical Coverage Policy 8C](https://medicaid.ncdhhs.gov/8c-outpatient-behavioral-health-services-provided-direct-enrolled-providers/download?attachment=) - Headway, [credentialing timelines](https://help.headway.co/hc/en-us/articles/360058294552-Credentialing-with-Headway) and [provider referral rewards](https://help.headway.co/hc/en-us/articles/11559127552404-Provider-referral-rewards-program); Alma, [referring colleagues](https://support.helloalma.com/hc/en-us/articles/360015279073-Referring-Your-Colleagues-to-Alma) - Duncan, Miller et al., [The Session Rating Scale](https://www.scottdmiller.com/assets/uploads/documents/SessionRatingScale-JBTv3n1.pdf); de Jong et al. 2021, [progress feedback meta-analysis](https://pure.uva.nl/ws/files/68128665/Using_progress_feedback_to_improve_outcomes_and_reduce_drop_out_treatment_duration_and_deterioration_A_multilevel_meta_analysis.pdf); Talkiatry, [early dropout thresholds](https://www.prnewswire.com/news-releases/talkiatry-study-identifies-clear-thresholds-predicting-early-dropout-in-telepsychiatry-302638961.html) - OIG, [gifts of nominal value policy statement](https://oig.hhs.gov/documents/special-advisory-bulletins/887/OIG-Policy-Statement-Gifts-of-Nominal-Value.pdf); Virginia, [12VAC30-130-2000](https://law.lis.virginia.gov/admincode/title12/agency30/chapter130/section2000/) - Midi Health: [The Story Exchange interview](https://thestoryexchange.org/menopause-care-grows-up-we-want-to-be-the-company-for-aging-beautifully/), [Kara Goldin Show](https://karagoldin.com/podcasts/joanna-strober/), [Fierce Healthcare on the Series D](https://www.fiercehealthcare.com/health-tech/womens-health-clinic-midi-health-closes-100m-series-d-round-hitting-1b-valuation) - Minor consent statutes: [Md. Health-Gen. § 20-104](https://youthlaw.org/sites/default/files/2024-10/NCYLMinorConsentCompendium2024-Maryland.pdf), [Va. Code § 54.1-2969](https://law.lis.virginia.gov/vacode/title54.1/chapter29/section54.1-2969/), [D.C. Code § 7-1231.14](https://code.dccouncil.gov/us/dc/council/code/sections/7-1231.14), [N.C.G.S. § 90-21.5](https://www.ncleg.net/enactedlegislation/statutes/html/bysection/chapter_90/gs_90-21.5.html) - Cap, [HIPAA-compliant screen recording](https://cap.so/hipaa-compliant-screen-recording) and the August 13, 2026 changelog *Written September 2026.*